Vendor
SDL_mixer versions 3.1.2 through 3.2.4 are vulnerable to a stack-based buffer overflow in the FetchXLaw function that can be triggered by malicious AIFF-C files.